Add a conditional permission for ABAC (Attribute-Based Access Control). This moves from RBAC to ABAC, allowing context-aware policie

Add a message to the task conversation.

Register an SLO.

Append a measurement (thread-safe).

Attempt to assign a task to a specific agent. Validates trust score and capability match.

Authorize an authenticated principal for a specific agent DID.

Governed batch execution. Each input in the batch is individually checked against the governance policy before the ba

Cancel a run (SIGKILL equivalent). ADK runs are local, so cancellation works by setting a flag that every governance hook checks. Whe

Verbatim adapter from docs/proposals/azure-aca-sandbox.md Step 7.

Check whether *agent_id* may proceed with an additional call. If *estimated_tokens* is provided, the check verifies that the agent wo

Check text against blocked patterns. Returns PolicyCheckResult with allowed=False if any pattern matches.

Check if a package version was published within the freshness window. Does NOT call external APIs — compares against a provided timestamp.

Check if a module import is allowed. Args: module_name: The module name to check. Returns: True if the impor

Main CLI entry point. Returns exit code.

Mark the experiment as completed.

Mark AI disclosure as confirmed for a session.

Connect to MCP server with trust verification.

Try to consume tokens. Returns True if successful.

Mock the create() method that returns tool calls

Factory function to create a sidecar proxy. Args: agent_url: URL of the backend agent (e.g., "http://localhost:8000") manife

Compare this policy with another, returning changed fields. Returns a dict mapping field names to (self_value, other_value) tuples fo

Evaluate a policy check in dry-run mode. Runs the wrapped integration's pre_execute and records the decision without blockin

Deserialize from dictionary.

Load a policy from a JSON string. Validates the ``apiVersion`` field against supported versions and emits deprecation warnings for ol

Create an AgentIdentity from a JWK. Args: jwk: A dict representing a JWK with Ed25519 key material. Returns:

Generate a batch of one-time pre-keys.

Get credit balance for an agent.

Get all policies applicable to a repo based on its tier.

Get summary of tool usage.

Get the effective capabilities at the end of the chain.

Get all valid (non-expired) endorsements for an agent. Args: target_did: The agent DID to query endorsements for. end

Get the most recent entries of a given event type.

Determine the output format from CLI arguments.

Return the most recent rotation proof. Raises: IdentityError: If no rotation has occurred yet.

Get current SLI values for integration with SLO engine.

Get all Flight Recorder entries as Lightning spans. Note: walks the full entry list every call. For polling loops prefer :me

Retrieve all log entries for a given trace ID.

Evaluate Cedar policy for a pipeline step and produce a signed receipt. Args: action: The pipeline action (e.g. LoadShard, RunInf

Create a GovernanceFunctionFilter.

Execute a tool call through the governance layer. Returns a mock result string on success, or None if blocked.

Guard a duck-typed Semantic Kernel KernelFunction.

Return True if self causally precedes other. Clock A happens-before clock B iff every component of A is <= the corresponding componen

Check if the permission is allowed given the context. Args: context: The evaluation context Returns:

Check if a tool is in a block list after canonicalization. Args: tool_name: Tool name to check. blocked_tools: List o

List all loaded policy names. Returns: List of registered policy name strings.

List templates with optional filtering.

Log a message with structured context

Log a query result.

Normalize a raw signal into a standard ContextObject. Args: raw_signal: Raw signal data from the source

Parse command line arguments.

Print a section header.

Assess rogue risk before allowing tool execution.

Generate and publish this agent's pre-key bundle. Args: include_otk: Whether to include a one-time pre-key. Returns:

Return rows for *name* with timestamp >= *since* (thread-safe).

Reactivate a suspended sponsor. Raises: ValueError: If the sponsor has been permanently revoked.

Read the content of a file. Args: path: Path of the file to read Returns: The f

Record a tool call and return ``True`` if it is a violation.

Record an exception.

Record a handshake with its duration and result. Args: duration_seconds: Handshake latency in seconds. result: Outcom

Record an interaction outcome to update trust scores. Valid outcomes: ``success``, ``failure``, ``timeout``, ``partial``. Positive outcomes r

Register a new sponsor. Args: sponsor: The HumanSponsor to register. Raises: ValueError: If a sponsor with t

Register a new agent on Nexus. Args: manifest: Complete agent manifest signature: Ed25519 signature

Register a schema for a topic. Args: topic: Topic pattern to register schema for schema: Schema spec

Register an agent with its termination callback.

Register a new agent with proof-of-possession.

Check if an action requires human approval per policy.

Revoke a credential and notify registered callbacks. Propagation target: ≤5 seconds to all systems. Args: credential_id:

Search plugins by name or description substring. Args: query: Case-insensitive search string. Returns: List

Select agents capable and trusted enough for a task. Returns agents sorted by trust score (highest first).