Verify the Ed25519 signature over the canonical payload. Returns False (fail-closed) when the cryptography package is not installed r

Verify the card's signature is valid. Returns: True if the signature is valid and matches the identity.

Record a write (Public Preview: never rejects).

AuditLog returns a snapshot of audit events.

GlobalKillSwitchScope returns the process-wide kill switch scope.

Len returns the number of registered extractors. Primarily for tests.

Metadata returns non-secret metadata for a credential, or (nil, nil) if absent.

NewCredentialVault creates an in-memory vault.

NewOPABackend creates an OPA/Rego backend. A `RegoPath` that cannot be read is logged at construction time and the backend falls back to an empty `re

NewSLOEngine creates an engine preloaded with objectives.

NewShadowDiscoveryScanner creates a scanner with built-in discovery heuristics.

Rotate rotates a credential's value while preserving the handle name.

ScanText returns low-level findings from a text blob.

VerifyPeer returns the current trust score but fails closed unless the caller has independent verification evidence beyond the peer's self-attested id

WithCapabilities sets capabilities on identity generation.

Return True iff ``adapter_module`` imports ``PII_PATTERNS`` from base.

Key for the set tracking all known agent DIDs.

Return approval timeout settings with invalid values failing closed. Missing ``timeout_seconds`` preserves the 300s default. Explicit zero, n

Raise RuntimeError if the engine is frozen.

Log event to audit trail.

Persist to file if file-backed storage is configured.

Decode base64url string without padding per RFC 7515. Mirrors the helper in agentmesh.identity.jwk for module independence.

Build a real :class:`AgtRuntime` from a v4 ``GovernancePolicy``. Translates the policy to an AGT manifest via :func:`agt.policies.bridge.gove

Calculate trust score from manifest.

Cap an already-buffered ``(stdout, stderr)`` tuple to *max_bytes*.

Parse the decision token from a ``cedar authorize`` invocation. Returns ``(allowed, parsed)``: - ``(True, True)`` if the first non-empty l

Pub/sub channel name.

Check if response matches ground truth.

Check if huggingface_hub is available and raise helpful error if not.

Check if huggingface_hub is installed. Raises: ImportError: If huggingface_hub is not installed.

Perform liveness check for an agent

Check if action is allowed under given policies.

SHA-256 of the enforcement-relevant authorization surface. Covers: - All enforcement-relevant policy fields (via to_dict()) -

Consume a demux ``exec_start(stream=True, demux=True)`` generator. Reads chunks until *max_bytes* is reached per channel, then stops. Returns

Convert a dataclass to a JSON-safe dictionary.

Find all plugin manifest files in immediate subdirectories. The directory root is also inspected so a single-plugin layout (manifest at the t

End the OTel span if present.

Begin a turn if one isn't active.

Evaluate via cedar CLI subprocess.

Find a registered substitute for the session, excluding the given agent.

Make ``import <name>`` raise ImportError for selected modules.

Return demo trust score history for an agent.

Get or create agent state.

Get deterministic content for signing.

Check if a potential secret matches allowed test patterns.

Return True if the exception is a transient OpenAI error.

Load a submodule from *pkg_dir* without triggering __init__.py.

Log an audit event.

Create a representative GovernancePolicy for adapter benchmarks.