Persist *bucket* for *agent_id*.

Set a gauge metric. Args: name: Metric name value: Value to set labels: Metric labels

Set the trust score for *plugin_name* (clamped to 0-1000).

Check if a schedule should fire at the given time. Evaluates the cron expression against the current time, checks that the schedule i

Determine if this request should use the new version. Uses deterministic hash-based routing if request_id provided,

Sign *data* with the private key of *agent_id*. Args: agent_id: Unique identifier of the agent whose key is used. dat

Sign data with the in-memory private key. Args: agent_id: Agent whose private key is used. data: Data to sign.

Start the worker thread. Idempotent.

Start a new session. Args: agent_id: Agent identifier. tags: Optional session tags. Returns: The

Stop the server subprocess.

Governed streaming execution. The input is policy-checked before streaming begins. Output chunks are buffered and pos

Submit a Datadog metric. Args: metric_name: Metric name (e.g. agent_sre.slo.budget_remaining) value: Metric value

Take a snapshot of all registered SLOs.

Convert event to dictionary.

Return only non-null trusted metadata sources.

Validate a payload against the schema. Args: payload: The payload to validate Returns:

Validate an agent attestation record. Args: attestation: The attestation record to validate verify_signature

Validate a JWT token issued by Entra ID for this agent. .. warning:: This method does **not** verify the cryptographic signature

Verify an Ed25519 signature. Args: public_key: Raw Ed25519 public key bytes. data: Original data that was signed.

Validate synthetic evidence and return normalized attestation claims.

Verify claim against observation using mathematical drift detection. The Math decides, not the AI.

Run full integrity verification. Returns: An IntegrityReport with per-file and per-function results.

Verify that every delegated capability is a subset of the parent's. A capability is considered narrowed when it appears literally in

Extract and verify peer identity from a PEM-encoded certificate. Verification checks (in order): 1. Certificate is parseable as PEM X

Verify a token matches this credential. Args: token: The bearer token string to verify. Returns: True if the

Wrap a LangGraph StateGraph with governance hooks. Must be called **after** ``add_node()`` and **before** ``compile()``. Args:

Write to VFS path (if allowed).

DecisionFor resolves whether a specific agent/capability combination is currently allowed.

LegacyTrustedHeaderAgentIDResolver explicitly trusts a caller-supplied header for short-lived migrations. SECURITY: This resolver sets Verified=true

NewMcpSecurityScanner creates a scanner with an empty known-tools registry.

NewRingEnforcer creates an enforcer with empty assignments and no default permissions.

Scan inspects a single tool definition and returns the scan result.

State returns the current lifecycle state.

Add a control to the registry.

Return the absolute path to the AgentMesh state directory.

Call the GitHub REST API and return parsed JSON.

Call the GitHub REST API and return parsed JSON.

Safely get a positional argument.

Run *fn(sink)*, capture stdout output, and return parsed JSONL records.

Try to import a module and report success/failure.

Detect credibility-farming fork bursts (e.g., forking awesome lists). Forks that have at least one outgoing PR to their parent repo are exclu

Seed credits and create an escrow; return the escrow_id.

Emit a structured event. Logs via Python logging (for OTEL log exporters) and adds an event to the current span (for trace correlatio

Return the more severe of two decisions.

Rotate the current bucket if the window has elapsed.

Get or create reputation history for an agent.

Infer the ring ResourceType from an action string using exact token match.

Build a valid hash-chained list of receipts, optionally signed.

Create a mock CrewAI crew.

Create a sample trace with parent-child spans.

Return a mock boto3 bedrock-agent-runtime client.

Print data as JSON to stdout.

Record violation in audit trail and raise exception.

Resolve a path to its mount point and relative path. Returns (mount_point, relative_path)

Abort the experiment.

Convert a Copilot or Claude manifest dict into a canonical :class:`PluginManifest`. For ``"generic"`` format the data is passed straight through.

Add an agent to the scope chain. Returns False if max depth would be exceeded.

Register an MCP server package for vulnerability tracking.

Add a trusted public key from a Control Plane. Args: key_id: Identifier for the public key public_key: PEM-e