Return trust record for *agent_did* WITHOUT inserting on miss. Unknown DIDs get a fresh ``untrusted`` record returned by value; the i

Convert score to star rating.

Get statistics about observation activity.

Get current circuit breaker status.

Get tier for a score.

Get trust status report.

Temporarily route Python shell APIs through an OpenShell governance skill.

Guard an AutoGen-style agent method without importing AutoGen.

Guard a CrewAI-style crew/agent kickoff method without importing CrewAI. CrewAI 1.6 prompts for first-run trace viewing unless it detects a test

Handle MCP prompts/get request.

Check if there are any circular dependencies

Check if any registered action is non-reversible.

Check if agent advertises a specific skill.

Find the highest tier an agent qualifies for. Evaluates from GOLD down to BRONZE, returning the first passing tier. If no tier passes

Extract Hyperlight-relevant fields from a policy. Reads well-known attributes (``defaults.max_memory_mb``, ``defaults.timeout_seconds``, ``sa

Import reputation data from other nodes in the network. Args: data: Dictionary of reputation scores from other nodes

Increment a counter metric.

Increment a counter metric

Async version of intercept_tool_execution for non-blocking operation. This is the production-ready async implementation that support

Execute the plan with step-by-step governance validation. Before execution, each step is checked against ``allowed_tools``. Execution

Check if this agreement is active (not expired or revoked).

Check if OTel observability is enabled and functional.

Check if the current time falls within any blackout window. Args: schedule: The schedule whose blackout windows to check.

Check if a card is verified (with caching).

Check if verification result passes this profile's thresholds.

Inject latency into a target.

List all checkpoint images for the agent.

List all registered SLI type names.

Parse and load a YAML string as a Policy document.

Load a .cedar file alongside YAML/JSON and Rego policies. Cedar evaluators run after Rego: YAML rules first, then Rego, then

Parse a simple YAML-like egress policy and add rules. Supported format (stdlib-only, no PyYAML dependency):: rules:

Convenience: register an OPA/Rego backend. Args: rego_path: Path to a ``.rego`` file. rego_content: Inline Rego polic

* Log an action to the audit trail.

Create audit entry with hash chain.

Log artifact data. Args: run_name: Name of the run this artifact belongs to. artifact_path: Path/name for the artifac

Log a request that was blocked by security policies.

Log an error during request processing.

Log a trust handshake event.

Log a response from an agent.

Create a new episode marked as a failure (immutable pattern). Args: reason: Optional reason for the failure

Return True if the given action + params match this planned action.

Merge a top-level governance section across documents (last writer wins). Used for sections like ``tools``, ``annotators``, ``policies``, ``l

ISO timestamp for N minutes ago.

Check if SVID needs rotation. Args: threshold_minutes: Minutes before expiry to trigger rotation. Returns: T

Called when a chain finishes executing.

Called when a chain starts executing.

Called when control transfers from one agent to another. Governance actions performed: 1. **Handoff limit** — increments the handoff

Called when LLM errors out.

Intercept broadcast/published messages. Scans published messages for blocked patterns and PII before they reach subscribers.

Snapshot for the ``output`` intervention point (§2.7).

Extract inspectable Streamable HTTP and legacy SSE MCP server configs.

Extract inspectable stdio MCP server configs. Supports Claude Desktop style ``mcpServers`` and VS Code-style ``servers``. Remote HTTP-family

Attempt to bypass a governance policy.

Print polymorphic response and UI component.

Print a formatted section header

Quarantine the agent due to a security or trust issue.

Get all events for a specific session.

Query learned behavior patterns. Args: trigger: Optional trigger to filter by min_confidence: Minimu

Create a server-side span for an incoming A2A request. Call this on the *receiving* agent to link the incoming request back to the ca

Run reconciliation and return shadow agents. For each agent in the inventory: - If registered → mark as REGISTERED - If not r

Record agent behavior for baseline establishment

Record an event in a session. Args: session_id: Session ID. event_type: Type of event. data: Optional eve

Record a failed action and return the updated score.

Record a metric for an agent

Increment the policy-violation counter. Args: policy_id: Identifier of the violated policy.

Record a completed saga span as a native OTel span. Args: name: Span name (e.g. ``saga.step.validate``). start_time:

Record successful task execution. Returns the new trust score.

Record a successful action and return the updated score.

Record token consumption and return the updated status. Fires the ``on_warning`` callback the first time the warning threshold is cro

Increment the failed verifications counter. Args: reason: Failure reason label.

Increment the violation counter. Args: violation_type: Type of violation (e.g. ``"scope_exceeded"``).