Check if the user has a specific permission.

Check if a topic has a registered schema.

Return a salted SHA-256 hex digest of *query*. Unsalted SHA-256 over a short query string is trivially reversible via rainbow tables

Make a HEAD request (useful for checking if resource exists). Args: url: URL to check Returns:

Return a health-check snapshot for monitoring integrations. Returns: A dict with ``status`` (``"healthy"`` or ``"degraded"``),

Return adapter health status. Returns: A dict with ``status``, ``backend``, ``last_error``, and ``uptime_seconds`` ke

Return adapter health status. Returns: A dict with ``status``, ``backend``, ``last_error``, and ``uptime_seconds`` ke

Record a heartbeat from an agent. Returns False if agent not found.

Set hash field value.

Trace a generic HTTP call.

Apply inline Markdown formatting (bold, code).

Inspect selected MCP servers across stdio, Streamable HTTP, and legacy SSE.

Enforce constraint graph for a ``ToolCallRequest``. Imports are deferred to avoid circular dependency with ``integrations.base``.

Always returns False (Public Preview: no skip-on-replay).

Check if identity is active and not expired.

Check if an agent is currently hibernated

True for verdicts that permit the action (``allow``/``warn``/``transform``). Mirrors the v4 ``PolicyCheckResult.allowed`` boolean but reads

Check whether a request has been cancelled. Args: request_id: The request identifier to check. Returns: ``Tr

Check if the attestation has expired. Args: current_time: Current time in ISO 8601 format Returns:

Check if both parties have signed.

Return True only for agents we've explicitly recorded interactions with.

Check if Nexus has witnessed this receipt.

Check if the grant is currently active and not expired.

Issue an SVID for an agent. Args: agent_did: The agent's DID. Returns: The newly issued SVID, or None if the

Run crew with trust enforcement. Verifies trust for all agents, then attempts to run the crew via CrewAI (if installed) or returns a

Update the wisdom database based on analysis. Also updates prioritization framework with safety corrections. With Wi

Extract user preferences from feedback. This is called when user provides feedback on agent behavior. Note:

List all registered agents.

Return names of all registered backends.

List all files in the session VFS.

List files in a directory. Args: directory_path: Path of the directory to list recursive: Whether to

List all pending escalation requests.

List available SLO template names.

List all registered tool names. Returns: A list of tool name strings currently in the registry.

Load attestation from a JSON file.

Load rules from a list of dicts (e.g., from YAML config).

Load chaos schedules from a YAML file. Args: path: Path to the YAML configuration file. Returns: List of validated ChaosSche

Log a cost alert. Args: agent_id: Agent identifier severity: Alert severity (info, warning, critical) mes

Log an execution error. Updates the audit entry to ``error`` status. Unlike violations, errors indicate that the tool was *allowed* b

Log a batch of evaluations as an experiment. Args: experiment_name: Name of the experiment entries: List of evaluatio

Log an incident detection. Args: incident_id: Unique incident identifier title: Incident title severity:

Log SLO evaluation as Helicone feedback. Args: helicone_id: Helicone request ID slo_name: SLO name status

Log an SLO status transition. Args: slo_name: Name of the SLO old_status: Previous status new_status: New

Return whether a report-data hash matches the expected ADR 0010 binding.

Build an :data:`ApprovalResolver` from an MCP elicitation callable. ``elicit`` is a duck-typed callable matching MCP elicitation: it is invoked

Search kernel memory with governance logging. The search operation is recorded in the audit trail (query text is truncated to 100 cha

Merge with another principle set.

Migrate a policy YAML document to the target schema version. Currently supports: - ``1.0`` → ``governance.toolkit/v1``: Adds ``apiVersion`` f

Mount a backend at the specified path. Args: path: Mount point (e.g., "/mem/semantic") backend: VFS

Mount a document in the VFS

Advance to the next event in a step-by-step replay session. Args: session_id: Replay session identifier

Convert file change event to ContextObject.

Convert log stream event to ContextObject.

Convert audio stream event to ContextObject.

normalizeIdent takes the last dotted segment of an identifier and strips surrounding quotes/brackets, mirroring Python sqlglot Table.name.

Normalize MCP tool metadata to the shape MCPSecurityScanner expects.

Send a JSON-RPC notification.

Called when an agent finishes execution. Governance actions performed: 1. **Post-check** — validates output via ``post_execute()``.