True when the system is ready to serve (not UNHEALTHY).

Learn a new behavior pattern. Args: pattern: Behavior pattern to learn

List all registered tools with optional filtering. Args: tag: Filter by tag cost: Filter by cost level si

Load a trace by ID.

* Log an audit entry

Log a run with SRE metrics. Args: run_name: Name for the W&B run. metrics: Metrics dict to log. config: O

Convenience factory for :class:`RAGAuditEntry`. Args: agent_id: Agent identifier. collection: Target collection name. que

Build an AgentManifest for tests.

Subscribe a detail panel to receive rich data on each refresh cycle.

Called when LLM finishes generating.

Parse a capability string into (action, resource, qualifier).

Print a formatted header.

Print an info line.

Print a formatted section header

Print a section header.

Record pre/post execution audit entries with timing.

Register a newly published plugin version.

Publish an event to all subscribers.

Store or replace a credential. Returns its opaque handle.

Read from VFS path.

Refresh the attestation hash. Hashes all semantically meaningful fields so that any modification to the attestation (flipping ``passe

Find optimal models meeting quality/latency constraints, sorted by cost.

Record a CMVK verification.

Record a single execution for metrics tracking. Args: version: "old" or "new" success: True if task

Record a failure, reducing trust.

Record (or update) a quality score for a plugin dimension.

Record a trust score (0-1000 scale, normalized to 0-1).

Register extractor for sub-dicts stored at context_key.

Register a tool in the kernel's tool registry. Registered tools can be invoked by agents via the ``SYS_EXEC`` syscall. The kernel wra

Release an allocation and move it to history.

Reset the call counter for a policy (e.g., between requests).

Restore a checkpoint — destroy current, recreate from image.

Run the evaluation suite. This is like running "pytest" but for AI systems. Returns aggregate metrics and pass/fail

Run all provided playbooks and return their results.

Run a transaction through the full AML pipeline.

Snapshot the session's container via ``docker commit``.

Search knowledge base for relevant articles. In production, this would use vector similarity (Pinecone/ChromaDB).

Set or update a condition, replacing any existing one of the same type.

Set the resource quota for an agent

Set the trust score for the agent.

Sign a plugin manifest in place. Args: manifest: Manifest to sign. Returns: A copy of the manifest with the

Sign a receipt with an Ed25519 private key (hex-encoded 32-byte seed).

Send a POSIX-style signal to a governed agent. Supported signals: * ``SIGSTOP`` — pause the agent; all intercepted methods will

Start the agent.

Execute a single task with governance. This is the main entry point for Agent-Lightning integration. Args: inpu

Governed streaming chat. The input is policy-checked before the stream begins. Inspectable stream responses are aggre

Submit a new dispute for resolution. Args: escrow_id: ID of the disputed escrow disputing_party: Who

Summarize a batch of episodes into a semantic rule. Args: episodes: List of episodes to summarize su

Switch traffic from the active to the inactive environment. The current active environment transitions to DRAINING, and the inactive

Serialize to AI Card JSON for ``/.well-known/ai-card.json``. Returns: JSON string conforming to the AI Card spec.

Convert episode to JSON string.

Serialize policy to YAML string.

Save current role assignments and custom definitions to a YAML file.

Remove this hook from sys.meta_path.

Remove an agent from the revocation list. Returns: True if the agent was revoked and is now unrevoked, False if not found.

Validate the full chain and check required_scopes are reachable. Returns: (True, "") on success. (False, reason) on a

Validate request against security policy. Args: request_data: The request data to validate user_id:

Get measurements within the current time window.

Verify a session's audit log root.

Verify trust for a connection between two components.

Verify agent behavior via Verification adapter. If drift exceeds threshold, automatically slashes the agent and reports to N

Verify the entire chain integrity.

Verify a JSON-lines audit file. Args: path: Path to the audit file. secret_key: HMAC secret used when entries were wr

Verify the integrity of the audit log. Flushes any buffered writes, then walks the entire audit log in insertion order performing two

Verify the Ed25519 signature on a receipt. Returns ``False`` if unsigned or invalid.

ComputeDiscoveryFingerprint returns a stable deduplication key from merge keys.

NewCedarBackend creates a Cedar backend. File-system reads (PolicyPath, EntitiesPath) and JSON parsing of the entities file are best-effort: failures

Register adds an extractor for sub-maps stored at contextKey.

Resolve returns a single PolicyDecision from a set of candidates using the configured strategy.

Log an audit event