Scan multiple inputs for prompt injection. Args: inputs: Sequence of ``(text, source)`` tuples. canary_tokens: Option

Detect the appropriate output modality. Args: input_context: Context in which input was received dat

Distribute rewards from *pool* using the named strategy. Args: pool: The reward pool to distribute. strategy_name: St

Mark an agent as draining (no new work).

Evaluate an action against governance policy.

Evaluate a system prompt for missing defenses. Args: prompt: The system prompt text to audit. Returns: A com

Execute a callable function directly on the host. Args: func: The callable function to execute. args: Diction

Validate, then ``exec`` source code under all sandbox protections. Fail-closed flow: 1. Parse and AST-validate ``code``. Any violati

Execute a device command with full safety checks.

Export an entire Agent SRE trace as OTEL spans. Preserves span hierarchy by building parent-child links. Args: sre_trace

* Run all registered extractors against `context`. Mutates the top-level * `context` map (replacing the slot for each registered key with a fresh

Create a failed handshake result.

Get alerts that are currently firing.

Create event from dictionary.

Load agent configuration from a YAML or JSON file. Args: path: Path to a .yaml, .yml, or .json config file Returns:

Create an A2A Agent Card from AgentMesh identity fields. ``capabilities`` are mapped to A2A skills (one skill per capability).

Create an AgentIdentity from a JWK. Args: jwk: A dict representing a JWK with Ed25519 key material. Returns: A new AgentIden

Load an SLO spec from a YAML file.

Generate a new trace ID.

Generate a UI component spec from a polymorphic response. Args: response: The polymorphic response from the agen

Generate the AgentRollout CustomResourceDefinition manifest. Returns a dict suitable for serialisation to YAML and ``kubectl apply``.

Generate an Ed25519 key pair for testing and development. Returns: (private_key_b64, public_key_b64) as base64-encoded strings. Rais

Generate an Ed25519 keypair for the given agent. Args: agent_id: Unique identifier of the agent. Returns: Th

Generate an integrity manifest from current module state. Writes a JSON file containing SHA-256 hashes of all governance module sourc

Generate a YAML policy string from a named template.

* Get all logs

Get or create the singleton server instance.

Get all test prompts

Get backpressure statistics. Args: topic: Optional topic to get stats for. If None, returns all topics.

Get confidence level enum.

Get the conversation history (last N turns). Returns the history in FIFO order (oldest to newest). All turns are per

Get Trust Gateway deployment information. Returns: Deployment configuration and status

Return context from requested layers.

Fetch Entra group memberships for a service principal. Calls ``GET /servicePrincipals/{id}/memberOf/microsoft.graph.group``

Generate Helicone-compatible HTTP headers. Args: session_name: Session identifier for grouping requests. user_id: Opt

Get recent events, optionally filtered by type.

Return a copy of all delivery records.

Get or create a GovernanceLogger instance (cached per name).

Calculate metrics for a specific version within a time window. Args: version: "old" or "new" window_

Get only entries added since the last call. Previous implementation called :meth:`get_spans` (which walks all entries) on ev

Return the governance policy template for an agent's role.

Get a threshold profile by name. Args: name: Profile name (string or ProfileName enum) Returns: ThresholdProfile config

Get the current replica count for an agent type

Get current trust score for an agent.

Get statistics about the adapter's activity. Returns: Dictionary with statistics from the control plane

Returns current analytics snapshot across all rolling windows.

Return a secure code template with placeholders filled in. Args: name: Template name (one of ``TEMPLATES`` keys). **k

Retrieve the trust score for an agent. Args: agent_did: DID of the agent. Returns: Trust score dict, or None

Execute a tool call through the SOC2 governance layer. Returns the mock result string on success, or None if blocked.

Handle an A2A protocol message with governance. This is the main entry point for A2A messages from other agents. It

Check whether a valid endorsement of the given type exists.

Return a deterministic SHA-256 hash for canonically serializable context. This is a lightweight, best-effort fingerprint for observability.

SHA-256 of tool arguments as canonical JSON. ``None`` or empty → hash of ``{}``.

* Convert an AGT agent identity to an AI Card.

Evaluate a tool call against the governance policy. Routes the evaluation through the AGT 5.0 ACS engine at the ``pre_tool_call`` int

Check if the identity is active and not expired.

Check whether a run has been cancelled via :meth:`cancel_run`. Args: run_id: The run identifier to check. Returns:

Check if credential is about to expire. Args: threshold_seconds: Number of seconds before expiry to consider "exp

Return True when the batch should be flushed.

Load a .rego file alongside YAML/JSON policies. The OPA evaluator runs in parallel: YAML rules are checked first, and if no

Log a run with SRE metrics. Args: run_name: Name for the MLflow run. metrics: Metrics dict to log. params

Log a policy violation for a trace. Updates the audit entry identified by ``trace_id`` to ``blocked`` status and records the reason.

Look up content in cache. Args: context: The context to look up metadata: Optional metadata for key

Called when LLM starts generating.

Open an E2E encrypted channel to a peer after trust verification. The flow is: 1. Run TrustHandshake (Ed25519 challenge-response + tr

Create a copy of *base* with the given field overrides applied.

Send a prediction request to a Flowise chatflow. Args: flow_id: The Flowise chatflow ID. question: The user question/

Print a formatted section header

Return the public key corresponding to the signing key.