Guard a LangChain-style async Runnable via ``ainvoke``.

Guard an OpenAI Agents SDK Runner-style async ``run`` method.

Handle an MCP protocol message with governance. This is the main entry point for MCP messages. It parses the JSON-RPC message, applie

Return adapter health status. Includes model-call counts, token usage, and cancellation metrics alongside the original health fields.

Record a fault injection event.

Install a plugin from the registry. Steps: 1. Resolve manifest from registry. 2. Verify Ed25519 signature (if a trust

Check whether the underlying OS process is still running.

logFlightRecord logs an entry to the flight recorder

* Register a callback for transport-level errors. * * Fires for: WebSocket errors (handshake, mid-stream), decrypt failures, * KNOCK protocol

Enqueue a governance event for async delivery. Non-blocking. If the queue is full, the oldest event is dropped (DROP_OLDEST policy: r

* Package an agent identity and optional policy rules into an OCI manifest.

Parse .agents/ directory.

Permissive policy for development and testing. High limits with no blocked patterns. All tools allowed. No human approval required. U

Print a success message.

Process a trust event with network propagation. Returns a dict of {agent_did: score_delta} for every affected agent.

Query the audit logs with filters. Opens a new read-only connection (safe for concurrent access under WAL mode) and returns matching

Record a successful interaction with an agent.

Record a tool call result.

Reward an agent for a successful action. Args: agent: The agent to reward. Its ``trust_score`` is modified in pla

Register a workflow bundle. Raises ``BundleValidationError`` if validation fails.

Register an agent for health monitoring

Register a tool with the server.

Release a slot.

Resolve a list of candidate decisions into a single winner. Args: candidates: One or more candidate decisions from matching rules

Run all (or filtered) scenarios. Args: agent_fn: The agent callable to benchmark. categories: Filter to specific cate

Set or update policy for a specific tool.

Sign a plugin manifest in place. Args: manifest: Manifest to sign. Returns: A copy of the manifest with the

Log a penalty event (Public Preview: no penalties applied).

Mark task as working.

Start the observer daemon in background mode. Args: poll_interval: How often to check for new signals (seconds)

Stop the observer daemon.

Submit an escalation request for human review.

Subscribe a handler to events matching a glob-style pattern. Args: pattern: Glob-style pattern (e.g., ``trust.*``, ``*``).

Create a successful handshake result.

Suspend this identity temporarily.

Convert to dictionary for serialization.

Validate an output against principles. Args: output: The text to validate context: Optional context

Validate a capability manifest against policies. This is the main integration point that validates incoming agent manifests

Verify a signature against this agent's public key.

Verify full chain integrity: hash correctness and parent linkage.

Verify log integrity.

Governance gate around each model invocation. Performs the following checks **before** the model call: 1. Content-filter scan on inp

Create a SemanticKernelWrapper with test policy.

NewKillSwitchRegistry creates an empty scoped kill switch registry.

Run starts the sidecar server

Detect issues that promote the author's own repos across other orgs. Distinguishes between thin-credibility spam and legitimate cross-ecosystem

Map composite score to a risk level. Thresholds (mirroring ``AnomalySeverity`` boundaries): * < 1.0 → LOW * < 2.0 → MEDIUM

Extract text content from various message types. Parameters ---------- message : Any A message that may be a stri

Detect language from file extension.

Build a prefixed key for an agent.

Helper to create a minimal ScopeChain.

Create a mock SK function invocation context.

Return a ``GovernanceInstrumentor`` wired to mock OTel primitives.

Build a fake JWT with the given payload (no real signature).

Create a mock LangChain ModelRequest.

Build a duck-typed policy stand-in. PolicyEvaluator import will fail (agent-os-kernel not installed in this test env), so the provider runs wi

Create a simple SLO for testing.

Create a mock GitHub user profile.

Convert Python type annotation to ParameterType. Args: python_type: Python type annotation Returns: Corresponding ParameterT

Record an audit entry and return it.

Convert run_id (UUID or str) to string.

Create a valid sponsor signature for a registration request.

Simulate on_query_start → on_query_end (or on_query_error).

Execute a validated state transition.

Core stale-auth validation logic. Raises: PolicyViolationError: If fingerprint is missing or mismatched and ``aud

Verify handshake response with Ed25519 signature verification. Checks performed in order: 1. Challenge ID matches 2. Challeng

Materialise a miniature ATR rules/ directory at *root*.