Run async post-execution validation and return the legacy tuple. Args: ctx: Execution context for the governed operation.

Run async post-execution validation and return a structured result. Args: ctx: Execution context for the governed operation.

Run async pre-execution policy checks and return the legacy tuple. Args: ctx: Execution context for the governed operation.

Run async pre-execution policy checks and return a structured result. Args: ctx: Execution context for the governed operation.

Return a stable HMAC-SHA256 digest of an audit-event sequence. Useful for downstream tamper-evidence checks. The digest covers handle names a

Log an audit event at INFO level.

Return a copy of the audit log. Returns: A shallow copy of the in-memory ``AuditEntry`` list.

Scan the integrations package and register all BaseIntegration subclasses. Each subclass is registered under its class name. Returns the

Base64 encode as text.

Base64 encode bytes to text.

Token budget pre-check and model call counting.

Pre-tool governance check.

Build the final pipeline. Returns: Pipeline ready for execution.

Calculate a score for this agent for a given task. Scoring is based on: - Success rate: 30% weight (reliability)

Calculate weighted distance between two vectors. Currently supports weighted versions of: - euclidean: Weighted Euclidean distance

* Check if an agent can call its dependency (circuit breaker is not open).

Check whether *from_did* may delegate to *to_did*. Default: delegation is restricted to the same namespace only. Args: f

Check if an invoker can use this tool. Args: invoker_card: The invoking agent's card handshake: Trust handshake handl

Capture a point-in-time snapshot of agent state for time-travel debugging. Args: agent_id: Agent identifier

Perform the custom health check.

Pre-execution policy check.

Check health of all registered tools. Args: use_cache: Whether to use cached results. Returns: Dictionary ma

Check all tracked packages for vulnerabilities. Returns: Combined list of all vulnerabilities found.

Atomically check budget and record a cost. Combines :meth:`check_task` and :meth:`record_cost` in a single locked transaction so two

Check if API key is available.

Scan arguments for blocked patterns. Returns (allowed, reason).

Check if tool call count exceeds limit.

Detect exception details leaked to callers.

Detect hardcoded security deny-lists in source.

Check if a plugin version is allowed to be installed. Returns: Tuple of (allowed, reason). Deprecated plugins are allowed

Check if a value is an outlier using the IQR method. Returns (is_anomaly, distance_from_boundary).

Check for quota violations across all agents

Detect URLs from input used without SSRF validation.

Check if an agent meets the minimum trust threshold.

Detect pickle.loads without HMAC verification.

Create a child hierarchy node inheriting from this one.

Get child spans of a given span.

Remove expired entries and return the number removed.

Reset all dedup state.

Clear the provider cache. Useful for testing.

Clear classification cache (e.g., on manifest update).

Clear all conversation history.

Flush the output stream. Does NOT close the underlying stream.

Clean up resources by flushing the write buffer and closing connections.

Clean up environment resources.

Close an encrypted session and clear key material. Returns: True if a session existed and was closed.

Run integrity verification or generate manifest.

Enable kernel governance for the current directory.

Compare this policy with another, including version info. Returns a dict with version details and field-level changes.

Mark an operation as complete

Mark task as complete, awaiting validation.

Mark transfer as complete.

Compute SHA-256 hash of content.

Compute tamper-evident hashes for the reading and receipt.

Configure OpenTelemetry tracing with optional OTLP or console export. Args: service_name: Service name for traces. endpoint: OTLP

Try to consume *tokens*. Returns ``True`` when enough tokens exist.

Create an OutputGuardrail that validates output content against blocked patterns.

Inject conflicting directives to test conflict resolution.

Return number of registered agents.

Check if this delegation covers a category. Args: category: The category to check. Returns: ``True`` if the

Create a "Build a Website" workflow. This demonstrates: Product Manager → Coder → Reviewer pipeline.

Create a dashboard widget response for monitoring.

Create a default metadata manifest for the self-evolving agent. This demonstrates the standard format that all agents should publish.

Create a set of default security policies. .. deprecated:: The built-in rules are **samples** and are not guaranteed to be exhaus

Create an escrow for a task. Args: requester_signature: Base64-encoded Ed25519 signature of ``nexus.cryp

Create a concatenated search text from an episode.

Create the governance sidecar FastAPI application.

Create a table response for structured data.

Create a new conversation thread. The thread ID is automatically recorded in the execution context for audit purposes. Args:

Create a VFS state snapshot for rollback. Captures both VFS file state (snapshot) and participant metadata.

Simulate credential expiration for an agent.

Get current status of all SLOs.

Get the percentile latency value.

Return the most recent aggregate calibration delta within the window. Unlike the base ``SLI.current_value()`` which averages all window